TVN ID	TVN-202404009
CVE ID	CVE-2024-4298
CVSS	7.2 (High) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products	Affected products and versions： HGiga iSherlock (including MailSherlock , SpamSherock, AuditSherlock) 4.5、5.5 Affected components： iSherlock 4.5：iSherlock-query < 4.5-188 iSherlock 5.5：iSherlock-query < 5.5-188
Description	The email search interface of HGiga iSherlock (including MailSherlock, SpamSherock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability for Command Injection attacks, enabling execution of arbitrary system commands.
Solution	Update the iSherlock-query package to version 4.5-188 or later for iSherlock 4.5, and to version 5.5-188 or later for iSherlock 5.5.
Credit	Dong-Jie Chen (CHT Security)
Public Date	2024-04-29